# To modify multiple field names through logstash

**URL:** <https://discuss.elastic.co/t/to-modify-multiple-field-names-through-logstash/279876>\
**Category:** Logstash\
**Created:** [July 28, 2021, 2:39pm UTC](https://discuss.elastic.co/t/to-modify-multiple-field-names-through-logstash/279876 "2021-07-28T14:39:31Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![Cad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cad/32/86661_2.png) [@Cad](https://discuss.elastic.co/u/Cad)\
**Post date:** [July 28, 2021, 3:28pm UTC](https://discuss.elastic.co/t/to-modify-multiple-field-names-through-logstash/279876/2 "2021-07-28T15:28:06Z")

</div>

Hi,

If you know the name of the fields in advance, you can use the lowercase option of the mutate plugin documentation [here](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-lowercase).

If you don't know the name of the fields in advance, use a ruby script should be the best solution.  
A code already exist [here](https://discuss.elastic.co/t/lowercase-all-fields-and-sub-fields/174438/2). If you want to remove `jsonPayload.` from the beginning of all fields, edit this line of code `event.set(k.downcase, processObject(v))` to this

```auto
event.set(k.downcase.gsub(/jsonpayload\./, ''), processObject(v))
event.remove(k)

```

(the second parameter of gsub is 2 single quotes)

---

_[View the full topic](https://discuss.elastic.co/t/to-modify-multiple-field-names-through-logstash/279876)._